SCS-C02 Threat Detection and Incident Response Practice Test 15 — 15 Questions

Question 1

A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 2

A company uses Amazon RDS for its database. The security team needs to detect when a database instance is started or stopped outside of maintenance windows. Which AWS service should the team use to monitor these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including StartDBInstance and StopDBInstance calls from the RDS service. By monitoring CloudTrail logs, the security team can detect when a database instance is started or stopped outside of maintenance windows, as each API call is logged with a timestamp and user identity. CloudTrail is specifically designed for auditing API calls, making it the appropriate tool for this use case.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

AWS Config

Question 3

A company uses AWS CloudTrail to log all API activity. The security team wants to detect when an IAM user creates an access key for another user, which is a potential privilege escalation. Which TWO actions should the team take to set up this detection?

Accepted Answer

Create a CloudWatch alarm based on the metric filter.. Option C is correct because CloudTrail delivers API activity to a CloudWatch Logs log group, and a metric filter with a filter pattern matching the eventName "CreateAccessKey" converts those log events into a numeric CloudWatch metric that can be alarmed on. Option B is correct because a CloudWatch alarm on that metric filter's metric fires when the metric crosses the threshold, which is the standard way to detect and notify on the specific CreateAccessKey activity. Option A is not appropriate because AWS Config managed rules evaluate resource configuration compliance, not individual API calls. Option D is not correct for this two-action pair because an EventBridge rule that triggers a Lambda function is a separate single-step alternative, not one of the two actions needed in the CloudWatch Logs metric filter and alarm setup. Option E is wrong because GuardDuty custom threat lists are for IP addresses and domains, not for detecting specific IAM API calls.

Answer

Create an AWS Config managed rule to detect CreateAccessKey calls.

Answer

Use Amazon EventBridge to create a rule that matches the CloudTrail event and triggers an AWS Lambda function.

Answer

Enable Amazon GuardDuty and create a custom threat list.

Question 4

A company wants to use AWS services to detect and respond to a potential DDoS attack on their web application hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services should the company use for detection and mitigation?

Accepted Answer

AWS WAF. AWS WAF is correct because it allows you to create web access control lists (web ACLs) to filter and monitor HTTP/HTTPS requests to your Application Load Balancer. By defining rate-based rules, you can automatically block IP addresses that exceed a threshold of requests per 5-minute window, mitigating layer 7 DDoS attacks such as HTTP floods or SQL injection attempts.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Question 5

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a pre-built runbook, AWS-IsolateInstanceEC2, specifically designed to isolate an EC2 instance by modifying its security group to deny all inbound traffic. This runbook can be triggered directly by a CloudWatch Events rule that matches the GuardDuty finding, enabling fully automated incident response without custom code. Systems Manager Automation also supports cross-account and cross-region execution, making it suitable for enterprise-scale response orchestration.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS Config

Question 6

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

Accepted Answer

Use Amazon Athena with a table defined over the S3 bucket. Amazon Athena allows you to query CloudTrail logs directly in S3 using standard SQL without needing to move or transform the data. Since the logs are already in a centralized S3 bucket, defining a table over that location enables fast, ad-hoc queries to identify the specific DeleteBucket event, including who performed it and when. This approach is cost-effective and avoids additional streaming or storage costs.

Answer

Enable CloudTrail Lake

Answer

Stream logs to CloudWatch Logs and use CloudWatch Logs Insights

Answer

Enable Amazon GuardDuty

Question 7

A security team wants to detect and alert on API calls that create or modify IAM roles in their AWS account. Which AWS service can be used to create a metric filter and alarm for these specific CloudTrail events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can create metric filters on CloudTrail log data to detect specific API calls, such as CreateRole or UpdateAssumeRolePolicy. These metric filters can then trigger CloudWatch alarms for real-time notification. CloudTrail delivers logs to CloudWatch Logs, but the metric filter and alarm capabilities reside in CloudWatch Logs, not in CloudTrail itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to centralize threat detection and automatically remediate high-severity GuardDuty findings across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Enable GuardDuty in the management account and designate a delegated administrator to manage findings across all accounts. AWS Organizations allows you to enable GuardDuty in the management account and designate a delegated administrator, which automatically enables GuardDuty across all member accounts and centralizes finding management. This approach eliminates the need for per-account configuration or cross-account IAM roles, as the delegated administrator can view and manage findings from all accounts in a single GuardDuty console. It is the most efficient method because it leverages native AWS Organizations integration for automated, centralized threat detection and remediation.

Answer

Create a Lambda function that enables GuardDuty in each account using cross-account IAM roles

Answer

Configure Amazon EventBridge to forward findings from each account to a central account

Answer

Use AWS Security Hub and enable GuardDuty in each account separately

Question 9

A security engineer needs to ensure that any changes to an S3 bucket's public access settings are immediately detected and an alert is sent. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously monitors and records changes to AWS resource configurations, including S3 bucket public access settings. By creating a Config rule that triggers on changes to the `PublicAccessBlockConfiguration` or bucket ACLs, you can invoke an AWS Lambda function via an Amazon SNS topic to send an alert. This combination provides real-time detection and automated response to unauthorized public access changes.

Answer

Amazon GuardDuty and AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 10

During a security incident, a forensic investigator needs to capture the memory of a running EC2 instance without shutting it down. Which AWS feature should be used?

Accepted Answer

EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script. EC2 Rescue for Linux (via Systems Manager Run Command) includes a built-in script that can capture a full memory dump from a running EC2 instance without requiring a shutdown. This is essential for forensic analysis to preserve volatile data like running processes, network connections, and kernel structures. The script leverages the Linux 'vmcore' or 'LiME' (Linux Memory Extractor) tool to safely extract memory contents while the instance remains operational.

Answer

Amazon CloudWatch agent

Answer

AWS CloudTrail

Answer

Amazon EBS snapshot

Question 11

A company has a multi-account strategy and wants to ensure that all API calls from member accounts are logged to a centralized S3 bucket in the security account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that logs all accounts. AWS Organizations allows you to create an organization trail in the management account that automatically applies to all member accounts. This ensures that CloudTrail logs from every account in the organization are delivered to a single, centralized S3 bucket in the security account without needing per-account configuration. The organization trail uses the management account’s CloudTrail configuration to enable logging across the entire organization, and the S3 bucket policy must grant the necessary permissions for CloudTrail to write logs from all accounts.

Answer

Use Amazon Kinesis Data Streams to stream CloudTrail events from all accounts to the central S3 bucket

Answer

Create a CloudTrail trail in each member account and specify the same S3 bucket

Answer

Enable AWS Security Hub in the security account and configure it to collect CloudTrail logs

Question 12

A security team detects that an IAM user's access keys are being used from an unusual geographic location. Which AWS service provides this type of anomaly detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including anomalous API calls from unusual geographic locations. It uses machine learning models and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, making it the correct service for detecting IAM user access key usage from an unexpected region.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 14

A company uses AWS Organizations and wants to implement a centralized incident response process. Which THREE steps should be taken to ensure that security teams can respond to incidents across all accounts effectively?

Accepted Answer

Create IAM roles in each member account that grant incident responders cross-account access from the security account. Creating IAM roles in each member account with trust policies that allow the security account's incident responders to assume those roles enables centralized, cross-account access for incident response. This follows the principle of least privilege and allows the security team to perform actions (e.g., stopping instances, collecting forensic data) in any affected account without needing separate credentials or direct logins.

Answer

Set up AWS Systems Manager Incident Manager in each account independently

Answer

Create a single CloudTrail trail in the management account to log events from all accounts

Question 15

A security engineer needs to detect and respond to suspicious activity on an Amazon RDS database. Which TWO services can be used together to monitor database activity and trigger automated remediation?

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered by Amazon RDS database activity streams (e.g., via Amazon RDS for MySQL or PostgreSQL) or by Amazon CloudWatch Events/EventBridge rules that detect suspicious database events (such as failed login attempts or unusual query patterns). Lambda functions can then execute automated remediation actions, such as revoking database access, rotating credentials, or isolating the database instance. This enables a serverless, event-driven response to threats without manual intervention.

Answer

Amazon Detective

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon RDS Performance Insights